@learncard/sss-key-manager 0.2.6 → 0.3.0

package/dist/sss-key-manager.cjs.development.js

@@ -60,6 +60,7 @@ var require_types_cjs_development = __commonJS({
     var index_exports2 = {};
     __export2(index_exports2, {
       ACT_AS_HEADER: /* @__PURE__ */ __name(() => ACT_AS_HEADER, "ACT_AS_HEADER"),
+      AIPassportCredentialRecordValidator: /* @__PURE__ */ __name(() => AIPassportCredentialRecordValidator, "AIPassportCredentialRecordValidator"),
       AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX: /* @__PURE__ */ __name(() => AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX, "AUTH_GRANT_AUDIENCE_DOMAIN_PREFIX"),
       AchievementCredentialValidator: /* @__PURE__ */ __name(() => AchievementCredentialValidator, "AchievementCredentialValidator"),
       AchievementCriteriaValidator: /* @__PURE__ */ __name(() => AchievementCriteriaValidator, "AchievementCriteriaValidator"),
@@ -71,6 +72,8 @@ var require_types_cjs_development = __commonJS({
       AddTagInputValidator: /* @__PURE__ */ __name(() => AddTagInputValidator, "AddTagInputValidator"),
       AddressValidator: /* @__PURE__ */ __name(() => AddressValidator, "AddressValidator"),
       AgeRatingValidator: /* @__PURE__ */ __name(() => AgeRatingValidator, "AgeRatingValidator"),
+      AiSessionMode: /* @__PURE__ */ __name(() => AiSessionMode, "AiSessionMode"),
+      AiSessionModeValidator: /* @__PURE__ */ __name(() => AiSessionModeValidator, "AiSessionModeValidator"),
       AlignmentTargetTypeValidator: /* @__PURE__ */ __name(() => AlignmentTargetTypeValidator, "AlignmentTargetTypeValidator"),
       AlignmentValidator: /* @__PURE__ */ __name(() => AlignmentValidator, "AlignmentValidator"),
       AllocateCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshInputValidator, "AllocateCredentialRefreshInputValidator"),
@@ -78,6 +81,7 @@ var require_types_cjs_development = __commonJS({
       AllocateCredentialStatusInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialStatusInputValidator, "AllocateCredentialStatusInputValidator"),
       AllocatedBitstringStatusListEntryValidator: /* @__PURE__ */ __name(() => AllocatedBitstringStatusListEntryValidator, "AllocatedBitstringStatusListEntryValidator"),
       AllowConnectionRequestsEnum: /* @__PURE__ */ __name(() => AllowConnectionRequestsEnum, "AllowConnectionRequestsEnum"),
+      AnnouncementPreferencesValidator: /* @__PURE__ */ __name(() => AnnouncementPreferencesValidator, "AnnouncementPreferencesValidator"),
       AppBoostValidator: /* @__PURE__ */ __name(() => AppBoostValidator, "AppBoostValidator"),
       AppEventInputValidator: /* @__PURE__ */ __name(() => AppEventInputValidator, "AppEventInputValidator"),
       AppEventResponseValidator: /* @__PURE__ */ __name(() => AppEventResponseValidator, "AppEventResponseValidator"),
@@ -93,12 +97,15 @@ var require_types_cjs_development = __commonJS({
       AppStoreListingSubmitterValidator: /* @__PURE__ */ __name(() => AppStoreListingSubmitterValidator, "AppStoreListingSubmitterValidator"),
       AppStoreListingUpdateValidator: /* @__PURE__ */ __name(() => AppStoreListingUpdateValidator, "AppStoreListingUpdateValidator"),
       AppStoreListingValidator: /* @__PURE__ */ __name(() => AppStoreListingValidator, "AppStoreListingValidator"),
+      ArtifactSuggestionValidator: /* @__PURE__ */ __name(() => ArtifactSuggestionValidator, "ArtifactSuggestionValidator"),
       AssociationTypeValidator: /* @__PURE__ */ __name(() => AssociationTypeValidator, "AssociationTypeValidator"),
       AssociationValidator: /* @__PURE__ */ __name(() => AssociationValidator, "AssociationValidator"),
+      AttachCredentialRefreshStatusEntriesInputValidator: /* @__PURE__ */ __name(() => AttachCredentialRefreshStatusEntriesInputValidator, "AttachCredentialRefreshStatusEntriesInputValidator"),
       AuthGrantQueryValidator: /* @__PURE__ */ __name(() => AuthGrantQueryValidator, "AuthGrantQueryValidator"),
       AuthGrantStatusValidator: /* @__PURE__ */ __name(() => AuthGrantStatusValidator, "AuthGrantStatusValidator"),
       AuthGrantValidator: /* @__PURE__ */ __name(() => AuthGrantValidator, "AuthGrantValidator"),
       AuthSessionError: /* @__PURE__ */ __name(() => AuthSessionError2, "AuthSessionError"),
+      AuthenticatedMessageValidator: /* @__PURE__ */ __name(() => AuthenticatedMessageValidator, "AuthenticatedMessageValidator"),
       AutoBoostConfigValidator: /* @__PURE__ */ __name(() => AutoBoostConfigValidator, "AutoBoostConfigValidator"),
       BITSTRING_STATUS_PURPOSES: /* @__PURE__ */ __name(() => BITSTRING_STATUS_PURPOSES, "BITSTRING_STATUS_PURPOSES"),
       BitstringStatusListCredentialSubjectValidator: /* @__PURE__ */ __name(() => BitstringStatusListCredentialSubjectValidator, "BitstringStatusListCredentialSubjectValidator"),
@@ -110,19 +117,26 @@ var require_types_cjs_development = __commonJS({
       BoostRecipientValidator: /* @__PURE__ */ __name(() => BoostRecipientValidator, "BoostRecipientValidator"),
       BoostRecipientWithChildrenValidator: /* @__PURE__ */ __name(() => BoostRecipientWithChildrenValidator, "BoostRecipientWithChildrenValidator"),
       BoostValidator: /* @__PURE__ */ __name(() => BoostValidator, "BoostValidator"),
+      CONTRACT_APPROVAL_REQUIRED: /* @__PURE__ */ __name(() => CONTRACT_APPROVAL_REQUIRED, "CONTRACT_APPROVAL_REQUIRED"),
       CampaignAudienceInputValidator: /* @__PURE__ */ __name(() => CampaignAudienceInputValidator, "CampaignAudienceInputValidator"),
+      CampaignAudienceResultValidator: /* @__PURE__ */ __name(() => CampaignAudienceResultValidator, "CampaignAudienceResultValidator"),
       CampaignAudienceSourceValidator: /* @__PURE__ */ __name(() => CampaignAudienceSourceValidator, "CampaignAudienceSourceValidator"),
       CampaignChannelValidator: /* @__PURE__ */ __name(() => CampaignChannelValidator, "CampaignChannelValidator"),
+      CampaignDispatchOptionsValidator: /* @__PURE__ */ __name(() => CampaignDispatchOptionsValidator, "CampaignDispatchOptionsValidator"),
+      CampaignDispatchPreviewValidator: /* @__PURE__ */ __name(() => CampaignDispatchPreviewValidator, "CampaignDispatchPreviewValidator"),
+      CampaignEmailValidator: /* @__PURE__ */ __name(() => CampaignEmailValidator, "CampaignEmailValidator"),
       CampaignEventValidator: /* @__PURE__ */ __name(() => CampaignEventValidator, "CampaignEventValidator"),
       CampaignIdValidator: /* @__PURE__ */ __name(() => CampaignIdValidator, "CampaignIdValidator"),
       CampaignPaginationValidator: /* @__PURE__ */ __name(() => CampaignPaginationValidator, "CampaignPaginationValidator"),
       CampaignStatsValidator: /* @__PURE__ */ __name(() => CampaignStatsValidator, "CampaignStatsValidator"),
       CampaignStatusValidator: /* @__PURE__ */ __name(() => CampaignStatusValidator, "CampaignStatusValidator"),
+      CampaignTestValidator: /* @__PURE__ */ __name(() => CampaignTestValidator, "CampaignTestValidator"),
       CampaignUpdatesValidator: /* @__PURE__ */ __name(() => CampaignUpdatesValidator, "CampaignUpdatesValidator"),
       CampaignUserStateValidator: /* @__PURE__ */ __name(() => CampaignUserStateValidator, "CampaignUserStateValidator"),
       CampaignValidator: /* @__PURE__ */ __name(() => CampaignValidator, "CampaignValidator"),
       CapturedConsentRecordValidator: /* @__PURE__ */ __name(() => CapturedConsentRecordValidator, "CapturedConsentRecordValidator"),
       CapturedTemplateRecordValidator: /* @__PURE__ */ __name(() => CapturedTemplateRecordValidator, "CapturedTemplateRecordValidator"),
+      ChatMessageValidator: /* @__PURE__ */ __name(() => ChatMessageValidator, "ChatMessageValidator"),
       CheckCredentialEventValidator: /* @__PURE__ */ __name(() => CheckCredentialEventValidator, "CheckCredentialEventValidator"),
       CheckIssuanceStatusEventValidator: /* @__PURE__ */ __name(() => CheckIssuanceStatusEventValidator, "CheckIssuanceStatusEventValidator"),
       ClaimHookQueryValidator: /* @__PURE__ */ __name(() => ClaimHookQueryValidator, "ClaimHookQueryValidator"),
@@ -132,15 +146,26 @@ var require_types_cjs_development = __commonJS({
       ClaimTokenValidator: /* @__PURE__ */ __name(() => ClaimTokenValidator, "ClaimTokenValidator"),
       ClrCredentialValidator: /* @__PURE__ */ __name(() => ClrCredentialValidator, "ClrCredentialValidator"),
       ClrSubjectValidator: /* @__PURE__ */ __name(() => ClrSubjectValidator, "ClrSubjectValidator"),
+      ConsentFlowConsentStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowConsentStatusValidator, "ConsentFlowConsentStatusValidator"),
+      ConsentFlowContractChangeKindValidator: /* @__PURE__ */ __name(() => ConsentFlowContractChangeKindValidator, "ConsentFlowContractChangeKindValidator"),
+      ConsentFlowContractChangesValidator: /* @__PURE__ */ __name(() => ConsentFlowContractChangesValidator, "ConsentFlowContractChangesValidator"),
       ConsentFlowContractDataForDidValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDataForDidValidator, "ConsentFlowContractDataForDidValidator"),
       ConsentFlowContractDataValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDataValidator, "ConsentFlowContractDataValidator"),
+      ConsentFlowContractDetailChangeValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDetailChangeValidator, "ConsentFlowContractDetailChangeValidator"),
       ConsentFlowContractDetailsValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDetailsValidator, "ConsentFlowContractDetailsValidator"),
+      ConsentFlowContractDiffValidator: /* @__PURE__ */ __name(() => ConsentFlowContractDiffValidator, "ConsentFlowContractDiffValidator"),
+      ConsentFlowContractNotificationDataValidator: /* @__PURE__ */ __name(() => ConsentFlowContractNotificationDataValidator, "ConsentFlowContractNotificationDataValidator"),
       ConsentFlowContractQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowContractQueryValidator, "ConsentFlowContractQueryValidator"),
       ConsentFlowContractRequestForProfileListValidator: /* @__PURE__ */ __name(() => ConsentFlowContractRequestForProfileListValidator, "ConsentFlowContractRequestForProfileListValidator"),
       ConsentFlowContractRequestForProfileValidator: /* @__PURE__ */ __name(() => ConsentFlowContractRequestForProfileValidator, "ConsentFlowContractRequestForProfileValidator"),
       ConsentFlowContractRequestReadStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowContractRequestReadStatusValidator, "ConsentFlowContractRequestReadStatusValidator"),
       ConsentFlowContractRequestStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowContractRequestStatusValidator, "ConsentFlowContractRequestStatusValidator"),
+      ConsentFlowContractScopeValidator: /* @__PURE__ */ __name(() => ConsentFlowContractScopeValidator, "ConsentFlowContractScopeValidator"),
+      ConsentFlowContractStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowContractStatusValidator, "ConsentFlowContractStatusValidator"),
+      ConsentFlowContractUpdatePreviewValidator: /* @__PURE__ */ __name(() => ConsentFlowContractUpdatePreviewValidator, "ConsentFlowContractUpdatePreviewValidator"),
+      ConsentFlowContractUpdateResultValidator: /* @__PURE__ */ __name(() => ConsentFlowContractUpdateResultValidator, "ConsentFlowContractUpdateResultValidator"),
       ConsentFlowContractValidator: /* @__PURE__ */ __name(() => ConsentFlowContractValidator, "ConsentFlowContractValidator"),
+      ConsentFlowContractVersionValidator: /* @__PURE__ */ __name(() => ConsentFlowContractVersionValidator, "ConsentFlowContractVersionValidator"),
       ConsentFlowDataForDidQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataForDidQueryValidator, "ConsentFlowDataForDidQueryValidator"),
       ConsentFlowDataQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataQueryValidator, "ConsentFlowDataQueryValidator"),
       ConsentFlowGuardianApprovalValidator: /* @__PURE__ */ __name(() => ConsentFlowGuardianApprovalValidator, "ConsentFlowGuardianApprovalValidator"),
@@ -180,6 +205,7 @@ var require_types_cjs_development = __commonJS({
       CredentialActivityStatsValidator: /* @__PURE__ */ __name(() => CredentialActivityStatsValidator, "CredentialActivityStatsValidator"),
       CredentialActivityValidator: /* @__PURE__ */ __name(() => CredentialActivityValidator, "CredentialActivityValidator"),
       CredentialActivityWithDetailsValidator: /* @__PURE__ */ __name(() => CredentialActivityWithDetailsValidator, "CredentialActivityWithDetailsValidator"),
+      CredentialDisplayValidator: /* @__PURE__ */ __name(() => CredentialDisplayValidator, "CredentialDisplayValidator"),
       CredentialFormatValidator: /* @__PURE__ */ __name(() => CredentialFormatValidator, "CredentialFormatValidator"),
       CredentialInfoValidator: /* @__PURE__ */ __name(() => CredentialInfoValidator, "CredentialInfoValidator"),
       CredentialNameRefValidator: /* @__PURE__ */ __name(() => CredentialNameRefValidator, "CredentialNameRefValidator"),
@@ -187,11 +213,13 @@ var require_types_cjs_development = __commonJS({
       CredentialRefreshChallengeValidator: /* @__PURE__ */ __name(() => CredentialRefreshChallengeValidator, "CredentialRefreshChallengeValidator"),
       CredentialRefreshFailedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailedResultValidator, "CredentialRefreshFailedResultValidator"),
       CredentialRefreshFailureCodeValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailureCodeValidator, "CredentialRefreshFailureCodeValidator"),
+      CredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => CredentialRefreshReceiptValidator, "CredentialRefreshReceiptValidator"),
       CredentialRefreshResponseEnvelopeValidator: /* @__PURE__ */ __name(() => CredentialRefreshResponseEnvelopeValidator, "CredentialRefreshResponseEnvelopeValidator"),
       CredentialRefreshResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshResultValidator, "CredentialRefreshResultValidator"),
       CredentialRefreshSigningModeValidator: /* @__PURE__ */ __name(() => CredentialRefreshSigningModeValidator, "CredentialRefreshSigningModeValidator"),
       CredentialRefreshUnchangedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnchangedResultValidator, "CredentialRefreshUnchangedResultValidator"),
       CredentialRefreshUnsupportedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnsupportedResultValidator, "CredentialRefreshUnsupportedResultValidator"),
+      CredentialRefreshUpdateReasonValidator: /* @__PURE__ */ __name(() => CredentialRefreshUpdateReasonValidator, "CredentialRefreshUpdateReasonValidator"),
       CredentialRefreshUpdatedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUpdatedResultValidator, "CredentialRefreshUpdatedResultValidator"),
       CredentialRefreshVersionMetadataValidator: /* @__PURE__ */ __name(() => CredentialRefreshVersionMetadataValidator, "CredentialRefreshVersionMetadataValidator"),
       CredentialSchemaValidator: /* @__PURE__ */ __name(() => CredentialSchemaValidator, "CredentialSchemaValidator"),
@@ -199,8 +227,10 @@ var require_types_cjs_development = __commonJS({
       CredentialSharePreviewValidator: /* @__PURE__ */ __name(() => CredentialSharePreviewValidator, "CredentialSharePreviewValidator"),
       CredentialStatusValidator: /* @__PURE__ */ __name(() => CredentialStatusValidator, "CredentialStatusValidator"),
       CredentialSubjectValidator: /* @__PURE__ */ __name(() => CredentialSubjectValidator, "CredentialSubjectValidator"),
+      CredentialVerificationMetadataValidator: /* @__PURE__ */ __name(() => CredentialVerificationMetadataValidator, "CredentialVerificationMetadataValidator"),
       CriteriaValidator: /* @__PURE__ */ __name(() => CriteriaValidator, "CriteriaValidator"),
       DEFAULT_BITSTRING_STATUS_LIST_SIZE: /* @__PURE__ */ __name(() => DEFAULT_BITSTRING_STATUS_LIST_SIZE, "DEFAULT_BITSTRING_STATUS_LIST_SIZE"),
+      DebugInfoValidator: /* @__PURE__ */ __name(() => DebugInfoValidator, "DebugInfoValidator"),
       DeleteFrameworkInputValidator: /* @__PURE__ */ __name(() => DeleteFrameworkInputValidator, "DeleteFrameworkInputValidator"),
       DeleteShareLinkAttachmentChunksInputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksInputValidator, "DeleteShareLinkAttachmentChunksInputValidator"),
       DeleteShareLinkAttachmentChunksOutputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksOutputValidator, "DeleteShareLinkAttachmentChunksOutputValidator"),
@@ -212,6 +242,7 @@ var require_types_cjs_development = __commonJS({
       ESCROW_PIN_UNAVAILABLE_MESSAGE: /* @__PURE__ */ __name(() => ESCROW_PIN_UNAVAILABLE_MESSAGE2, "ESCROW_PIN_UNAVAILABLE_MESSAGE"),
       EncryptedCredentialRecordValidator: /* @__PURE__ */ __name(() => EncryptedCredentialRecordValidator, "EncryptedCredentialRecordValidator"),
       EncryptedRecordValidator: /* @__PURE__ */ __name(() => EncryptedRecordValidator, "EncryptedRecordValidator"),
+      EncryptionRecipientsResultValidator: /* @__PURE__ */ __name(() => EncryptionRecipientsResultValidator, "EncryptionRecipientsResultValidator"),
       EndorsementCredentialValidator: /* @__PURE__ */ __name(() => EndorsementCredentialValidator, "EndorsementCredentialValidator"),
       EndorsementSubjectValidator: /* @__PURE__ */ __name(() => EndorsementSubjectValidator, "EndorsementSubjectValidator"),
       EscrowPinStatusValidator: /* @__PURE__ */ __name(() => EscrowPinStatusValidator, "EscrowPinStatusValidator"),
@@ -225,6 +256,8 @@ var require_types_cjs_development = __commonJS({
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
       GetCredentialRefreshHistoryInputValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryInputValidator, "GetCredentialRefreshHistoryInputValidator"),
       GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
+      GetCredentialRefreshReceiptInputValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshReceiptInputValidator, "GetCredentialRefreshReceiptInputValidator"),
+      GetEncryptionRecipientsInputValidator: /* @__PURE__ */ __name(() => GetEncryptionRecipientsInputValidator, "GetEncryptionRecipientsInputValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
       GetShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => GetShareLinkAttachmentChunkInputValidator, "GetShareLinkAttachmentChunkInputValidator"),
@@ -232,6 +265,7 @@ var require_types_cjs_development = __commonJS({
       GetSkillPathResultValidator: /* @__PURE__ */ __name(() => GetSkillPathResultValidator, "GetSkillPathResultValidator"),
       GetTemplateRecipientsEventValidator: /* @__PURE__ */ __name(() => GetTemplateRecipientsEventValidator, "GetTemplateRecipientsEventValidator"),
       GuardianStatusValidator: /* @__PURE__ */ __name(() => GuardianStatusValidator, "GuardianStatusValidator"),
+      HolderEncryptedHandoffValidator: /* @__PURE__ */ __name(() => HolderEncryptedHandoffValidator, "HolderEncryptedHandoffValidator"),
       HolderExportConsentRecordValidator: /* @__PURE__ */ __name(() => HolderExportConsentRecordValidator, "HolderExportConsentRecordValidator"),
       HolderExportMetadataValidator: /* @__PURE__ */ __name(() => HolderExportMetadataValidator, "HolderExportMetadataValidator"),
       IdentifierEntryValidator: /* @__PURE__ */ __name(() => IdentifierEntryValidator, "IdentifierEntryValidator"),
@@ -251,7 +285,9 @@ var require_types_cjs_development = __commonJS({
       InlineSendCredentialEventValidator: /* @__PURE__ */ __name(() => InlineSendCredentialEventValidator, "InlineSendCredentialEventValidator"),
       InlineWalletCategoryValidator: /* @__PURE__ */ __name(() => InlineWalletCategoryValidator, "InlineWalletCategoryValidator"),
       InlineWalletSkillTagValidator: /* @__PURE__ */ __name(() => InlineWalletSkillTagValidator, "InlineWalletSkillTagValidator"),
+      InsightArtifactValidator: /* @__PURE__ */ __name(() => InsightArtifactValidator, "InsightArtifactValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name(() => InstalledAppValidator, "InstalledAppValidator"),
+      IntroStreamModeValidator: /* @__PURE__ */ __name(() => IntroStreamModeValidator, "IntroStreamModeValidator"),
       IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemResultValidator, "IssueInboxCredentialBatchItemResultValidator"),
       IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemValidator, "IssueInboxCredentialBatchItemValidator"),
       IssueInboxCredentialBatchResponseValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchResponseValidator, "IssueInboxCredentialBatchResponseValidator"),
@@ -303,6 +339,7 @@ var require_types_cjs_development = __commonJS({
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
+      LearningPathwayValidator: /* @__PURE__ */ __name(() => LearningPathwayValidator, "LearningPathwayValidator"),
       LegacySendCredentialEventValidator: /* @__PURE__ */ __name(() => LegacySendCredentialEventValidator, "LegacySendCredentialEventValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
       ListCampaignsInputValidator: /* @__PURE__ */ __name(() => ListCampaignsInputValidator, "ListCampaignsInputValidator"),
@@ -314,8 +351,11 @@ var require_types_cjs_development = __commonJS({
       MAX_SHARE_RECOVERY_JWE_BYTES: /* @__PURE__ */ __name(() => MAX_SHARE_RECOVERY_JWE_BYTES, "MAX_SHARE_RECOVERY_JWE_BYTES"),
       MAX_SHARE_SOURCE_URI_CHARS: /* @__PURE__ */ __name(() => MAX_SHARE_SOURCE_URI_CHARS, "MAX_SHARE_SOURCE_URI_CHARS"),
       MAX_VP_MEMBERS: /* @__PURE__ */ __name(() => MAX_VP_MEMBERS, "MAX_VP_MEMBERS"),
+      ManagedCredentialRefreshBindingValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshBindingValidator, "ManagedCredentialRefreshBindingValidator"),
       ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshReceiptValidator, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
+      ModelSafeCredentialFactValidator: /* @__PURE__ */ __name(() => ModelSafeCredentialFactValidator, "ModelSafeCredentialFactValidator"),
+      ModelSafeCredentialProjectionValidator: /* @__PURE__ */ __name(() => ModelSafeCredentialProjectionValidator, "ModelSafeCredentialProjectionValidator"),
       MyCampaignValidator: /* @__PURE__ */ __name(() => MyCampaignValidator, "MyCampaignValidator"),
       NormalizedConsentScopesValidator: /* @__PURE__ */ __name(() => NormalizedConsentScopesValidator, "NormalizedConsentScopesValidator"),
       PageCampaignAudienceInputValidator: /* @__PURE__ */ __name(() => PageCampaignAudienceInputValidator, "PageCampaignAudienceInputValidator"),
@@ -360,6 +400,7 @@ var require_types_cjs_development = __commonJS({
       PublishCredentialRefreshNotificationValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshNotificationValidator, "PublishCredentialRefreshNotificationValidator"),
       PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
       PublishCredentialSharePreviewValidator: /* @__PURE__ */ __name(() => PublishCredentialSharePreviewValidator, "PublishCredentialSharePreviewValidator"),
+      PublishHolderEncryptedRefreshInputValidator: /* @__PURE__ */ __name(() => PublishHolderEncryptedRefreshInputValidator, "PublishHolderEncryptedRefreshInputValidator"),
       PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
       PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
       PutShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => PutShareLinkAttachmentChunkInputValidator, "PutShareLinkAttachmentChunkInputValidator"),
@@ -377,6 +418,7 @@ var require_types_cjs_development = __commonJS({
       ResultStatusTypeValidator: /* @__PURE__ */ __name(() => ResultStatusTypeValidator, "ResultStatusTypeValidator"),
       ResultTypeValidator: /* @__PURE__ */ __name(() => ResultTypeValidator, "ResultTypeValidator"),
       ResultValidator: /* @__PURE__ */ __name(() => ResultValidator, "ResultValidator"),
+      RoleValidator: /* @__PURE__ */ __name(() => RoleValidator, "RoleValidator"),
       RubricCriterionValidator: /* @__PURE__ */ __name(() => RubricCriterionValidator, "RubricCriterionValidator"),
       SHARE_AAD_PREFIX: /* @__PURE__ */ __name(() => SHARE_AAD_PREFIX, "SHARE_AAD_PREFIX"),
       SHARE_CONTENT_KEY_BYTES: /* @__PURE__ */ __name(() => SHARE_CONTENT_KEY_BYTES, "SHARE_CONTENT_KEY_BYTES"),
@@ -395,6 +437,7 @@ var require_types_cjs_development = __commonJS({
       SendBrandingOptionsValidator: /* @__PURE__ */ __name(() => SendBrandingOptionsValidator, "SendBrandingOptionsValidator"),
       SendContractRequestValidator: /* @__PURE__ */ __name(() => SendContractRequestValidator, "SendContractRequestValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name(() => SendCredentialEventValidator, "SendCredentialEventValidator"),
+      SendHolderEncryptedRefreshableInputValidator: /* @__PURE__ */ __name(() => SendHolderEncryptedRefreshableInputValidator, "SendHolderEncryptedRefreshableInputValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name(() => SendInboxResponseValidator, "SendInboxResponseValidator"),
       SendInputValidator: /* @__PURE__ */ __name(() => SendInputValidator, "SendInputValidator"),
       SendNotificationEventValidator: /* @__PURE__ */ __name(() => SendNotificationEventValidator, "SendNotificationEventValidator"),
@@ -451,8 +494,10 @@ var require_types_cjs_development = __commonJS({
       SkillValidator: /* @__PURE__ */ __name(() => SkillValidator, "SkillValidator"),
       StandardCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => StandardCredentialRefreshServiceValidator, "StandardCredentialRefreshServiceValidator"),
       StatusCheckEntryValidator: /* @__PURE__ */ __name(() => StatusCheckEntryValidator, "StatusCheckEntryValidator"),
+      StatusManagementValidator: /* @__PURE__ */ __name(() => StatusManagementValidator, "StatusManagementValidator"),
       StoredCredentialEnvelopeValidator: /* @__PURE__ */ __name(() => StoredCredentialEnvelopeValidator, "StoredCredentialEnvelopeValidator"),
       StringQuery: /* @__PURE__ */ __name(() => StringQuery, "StringQuery"),
+      StructuredResponseValidator: /* @__PURE__ */ __name(() => StructuredResponseValidator, "StructuredResponseValidator"),
       SummaryCredentialDataValidator: /* @__PURE__ */ __name(() => SummaryCredentialDataValidator, "SummaryCredentialDataValidator"),
       SummaryCredentialKeywordValidator: /* @__PURE__ */ __name(() => SummaryCredentialKeywordValidator, "SummaryCredentialKeywordValidator"),
       SupportedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => SupportedCredentialRefreshServiceValidator, "SupportedCredentialRefreshServiceValidator"),
@@ -460,6 +505,9 @@ var require_types_cjs_development = __commonJS({
       TagValidator: /* @__PURE__ */ __name(() => TagValidator, "TagValidator"),
       TemplateRenderMethodValidator: /* @__PURE__ */ __name(() => TemplateRenderMethodValidator, "TemplateRenderMethodValidator"),
       TermsOfUseValidator: /* @__PURE__ */ __name(() => TermsOfUseValidator, "TermsOfUseValidator"),
+      ThreadCredentialContextValidator: /* @__PURE__ */ __name(() => ThreadCredentialContextValidator, "ThreadCredentialContextValidator"),
+      ThreadValidator: /* @__PURE__ */ __name(() => ThreadValidator, "ThreadValidator"),
+      TimingEventValidator: /* @__PURE__ */ __name(() => TimingEventValidator, "TimingEventValidator"),
       UnsignedAchievementCredentialValidator: /* @__PURE__ */ __name(() => UnsignedAchievementCredentialValidator, "UnsignedAchievementCredentialValidator"),
       UnsignedClrCredentialValidator: /* @__PURE__ */ __name(() => UnsignedClrCredentialValidator, "UnsignedClrCredentialValidator"),
       UnsignedVCValidator: /* @__PURE__ */ __name(() => UnsignedVCValidator, "UnsignedVCValidator"),
@@ -21978,12 +22026,47 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         $or: BaseStringQuery.array()
       })
     ]);
+    var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
+    var DEFAULT_BITSTRING_STATUS_LIST_SIZE = 131072;
+    var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
+    var BitstringStatusListEntryValidator = external_exports.object({
+      id: external_exports.string().optional(),
+      type: external_exports.literal("BitstringStatusListEntry"),
+      statusPurpose: BitstringStatusPurposeValidator,
+      statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
+      statusListCredential: external_exports.string()
+    });
+    var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
+      id: external_exports.string()
+    });
+    var BitstringStatusListCredentialSubjectValidator = external_exports.object({
+      id: external_exports.string().optional(),
+      type: external_exports.literal("BitstringStatusList"),
+      statusPurpose: BitstringStatusPurposeValidator,
+      encodedList: external_exports.string()
+    });
+    var AllocateCredentialStatusInputValidator = external_exports.object({
+      statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
+      listSize: external_exports.number().int().positive().optional()
+    }).default({});
+    var AttachCredentialRefreshStatusEntriesInputValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()).nullable()
+    });
     var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
     var ManagedCredentialRefreshServiceValidator = external_exports.object({
       id: external_exports.string().min(1),
       type: external_exports.literal("LearnCardCredentialRefresh2026"),
       authorization: LearnCardRefreshAuthorizationValidator.optional()
     }).catchall(external_exports.any());
+    var ManagedCredentialRefreshBindingValidator = ManagedCredentialRefreshServiceValidator.or(
+      RefreshServiceValidator.array().refine(
+        (services) => services.some(
+          (service) => ManagedCredentialRefreshServiceValidator.safeParse(service).success
+        ),
+        "A managed refresh service is required"
+      )
+    );
     var StandardCredentialRefreshServiceValidator = external_exports.object({
       id: external_exports.string().min(1),
       type: external_exports.literal("1EdTechCredentialRefresh")
@@ -22007,7 +22090,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     });
     var ManagedCredentialRefreshReceiptValidator = external_exports.object({
       refreshId: external_exports.string().min(1),
-      refreshService: ManagedCredentialRefreshServiceValidator,
+      refreshService: ManagedCredentialRefreshBindingValidator,
+      /** Legacy receipts authenticate only the allocated managed entry, not other services. */
+      refreshServiceBinding: external_exports.literal("managed-entry").optional(),
       credentialId: external_exports.string().min(1),
       issuerDid: external_exports.string().min(1),
       holderDid: external_exports.string().min(1),
@@ -22015,14 +22100,43 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         CredentialStatusValidator.array()
       ).optional()
     }).strip();
+    var GetCredentialRefreshReceiptInputValidator = external_exports.object({ uri: external_exports.string().min(1) });
+    var CredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.extend({
+      encryptionMode: external_exports.enum(["network", "holder"])
+    });
+    var HolderEncryptedHandoffValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      credentialId: external_exports.string().min(1),
+      holderDid: external_exports.string().min(1),
+      issuerDid: external_exports.string().min(1),
+      credentialStatus: CredentialStatusValidator.or(CredentialStatusValidator.array()),
+      refreshService: ManagedCredentialRefreshBindingValidator.optional(),
+      jwe: JWEValidator
+    }).strict();
+    var SendHolderEncryptedRefreshableInputValidator = external_exports.object({
+      handoff: HolderEncryptedHandoffValidator,
+      idempotencyKey: external_exports.string().min(1).optional(),
+      boostUri: external_exports.string().optional(),
+      skipNotification: external_exports.boolean().optional()
+    });
+    var GetEncryptionRecipientsInputValidator = external_exports.object({ refreshId: external_exports.string().min(1) });
+    var EncryptionRecipientsResultValidator = external_exports.object({
+      recipientKeyIds: external_exports.array(external_exports.string())
+    });
     var InboxCredentialRefreshReceiptValidator = ManagedCredentialRefreshReceiptValidator.omit(
       { holderDid: true }
     ).extend({ holderDid: external_exports.string().min(1).optional() });
     var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+    var CredentialRefreshUpdateReasonValidator = external_exports.enum(["corrected", "updated", "reissued"]);
     var PublishCredentialRefreshBaseFields = {
       refreshId: external_exports.string().min(1),
       notifyHolder: external_exports.boolean().optional(),
-      updateSummary: external_exports.string().optional(),
+      updateSummary: external_exports.string().max(280).optional().describe(
+        "Public legacy update summary. Do not include private claims; prefer updateReason."
+      ),
+      updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+        "Public reason for this update"
+      ),
       idempotencyKey: external_exports.string().optional()
     };
     var PublishIssuerSignedRefreshValidator = external_exports.object({
@@ -22098,13 +22212,25 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       publishedAt: external_exports.string().min(1),
       notification: PublishCredentialRefreshNotificationValidator
     });
+    var PublishHolderEncryptedRefreshInputValidator = external_exports.object({
+      handoff: HolderEncryptedHandoffValidator,
+      notify: external_exports.boolean(),
+      updateSummary: external_exports.string().max(280).optional().describe(
+        "Public legacy update summary. Do not include private claims; prefer updateReason."
+      ),
+      updateReason: CredentialRefreshUpdateReasonValidator.optional().describe(
+        "Public reason for this update"
+      ),
+      idempotencyKey: external_exports.string().optional()
+    });
     var CredentialRefreshVersionMetadataValidator = external_exports.object({
       version: external_exports.number().int().positive(),
       publishedAt: external_exports.string().min(1),
       effectiveAt: external_exports.string().optional(),
       etag: external_exports.string().optional(),
       signingMode: CredentialRefreshSigningModeValidator.optional(),
-      updateSummary: external_exports.string().optional()
+      updateSummary: external_exports.string().optional(),
+      updateReason: CredentialRefreshUpdateReasonValidator.optional()
     });
     var GetCredentialRefreshHistoryInputValidator = external_exports.object({
       refreshId: external_exports.string().min(1),
@@ -22147,6 +22273,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "INVALID_PROOF",
       "ISSUER_MISMATCH",
       "ID_MISMATCH",
+      "BINDING_MISMATCH",
       "ROLLBACK",
       "REVOKED",
       "UNSAFE_ENDPOINT"
@@ -22471,6 +22598,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         name: external_exports.string()
       })
     });
+    var CredentialDisplayValidator = external_exports.object({
+      name: external_exports.string().trim().min(1).max(280).optional(),
+      category: external_exports.string().max(280).optional(),
+      image: external_exports.string().max(2048).url().refine((url2) => url2.startsWith("https://"), { message: "Image URL must use https" }).optional()
+    });
     var SendBoostTemplateValidator = BoostValidator.partial().omit({ uri: true, claimPermissions: true }).extend({
       credential: VCValidator.or(UnsignedVCValidator),
       claimPermissions: BoostPermissionsValidator.partial().optional(),
@@ -22509,6 +22641,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateUri: external_exports.string().optional(),
       template: SendBoostTemplateValidator.optional(),
       signedCredential: VCValidator.optional(),
+      display: CredentialDisplayValidator.optional().describe(
+        "Public display metadata for managed and signed-only sends. Nothing is inferred from credential content; omitted names use generic copy. The exception is category: when display.category is omitted for an inline template, the template's category is copied, since consent-flow write authorization is keyed on it."
+      ),
+      statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
       options: SendOptionsValidator.optional().describe(
         "Options for email/phone recipients (Universal Inbox)"
       ),
@@ -22547,7 +22683,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         "Present when guardianEmail was specified"
       )
     });
+    var StatusManagementValidator = external_exports.enum(["network", "external", "mixed", "none"]);
     var SendBoostResponseValidator = external_exports.object({
+      /** Public status providers for a managed send; external entries require provider-side updates. */
+      statusManagement: StatusManagementValidator.optional(),
       type: external_exports.literal("boost"),
       credentialUri: external_exports.string(),
       uri: external_exports.string(),
@@ -22560,19 +22699,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       )
     });
     var PrepareRefreshableSendInputValidator = external_exports.object({
+      /** Opt in to signing the server-bound statusEntries; omission preserves client allocation. */
+      statusBinding: external_exports.literal("server").optional(),
+      statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
       recipient: external_exports.string(),
       templateUri: external_exports.string().optional(),
       template: SendBoostTemplateValidator.optional(),
+      display: CredentialDisplayValidator.optional().describe("Public display metadata only"),
       contractUri: external_exports.string().optional(),
       templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
       integrationId: external_exports.string().optional(),
       /** Credential ID to allocate for; generated server-side when omitted. */
       credentialId: external_exports.string().min(1).optional(),
-      idempotencyKey: external_exports.string().min(1).max(200).optional()
-    }).refine((data) => Boolean(data.templateUri) !== Boolean(data.template), {
-      message: "Provide exactly one of templateUri or template."
+      idempotencyKey: external_exports.string().min(1).max(200).optional(),
+      /**
+       * `'holder'` requests student-only encryption (LC-2345): the SDK signs and
+       * encrypts locally and the server never receives plaintext. Requires a
+       * profile or DID recipient; rejected for signedCredential-only sends and for
+       * inbox (email/phone) recipients. Defaults to `'network'`.
+       */
+      encryption: external_exports.enum(["network", "holder"]).optional()
+    }).refine((data) => !(data.templateUri && data.template), {
+      message: "Provide at most one of templateUri or template."
     });
     var PrepareRefreshableSendResultValidator = external_exports.object({
+      /** Public status providers known at preparation; final send reports the signed entries. */
+      statusManagement: StatusManagementValidator.optional(),
+      statusEntries: external_exports.array(BitstringStatusListEntryValidator).optional(),
       boostUri: external_exports.string(),
       credentialId: external_exports.string(),
       refreshId: external_exports.string(),
@@ -22580,11 +22733,111 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       /** The DID to use as credentialSubject.id (recipient DID, or the profile's did:web). */
       holderDid: external_exports.string(),
       /** Present when this idempotencyKey already completed: return it without signing. */
-      completed: SendBoostResponseValidator.optional()
+      completed: SendBoostResponseValidator.optional(),
+      /**
+       * Present only when `encryption: 'holder'` was requested: the exact
+       * key-agreement verification-method ids (holder + current managers) the SDK
+       * must encrypt to. Recomputed on every call, so a later manager change can
+       * make a previously-prepared set stale (see `credentialRefresh.sendHolderEncryptedRefreshable`
+       * and `credentialRefresh.getEncryptionRecipients`).
+       */
+      recipientKeyIds: external_exports.array(external_exports.string()).optional()
     });
     var SendInputValidator = external_exports.discriminatedUnion("type", [SendBoostInputValidator]);
     var SendResponseValidator = external_exports.discriminatedUnion("type", [SendBoostResponseValidator]);
-    var ConsentFlowTermsStatusValidator = external_exports.enum(["live", "stale", "withdrawn"]);
+    var ConsentFlowTermsStatusValidator = external_exports.enum([
+      "live",
+      "consumed",
+      "withdrawn",
+      "needs_reconsent",
+      "suspended"
+    ]);
+    var CONTRACT_APPROVAL_REQUIRED = "CONTRACT_APPROVAL_REQUIRED";
+    var ConsentFlowContractChangeKindValidator = external_exports.enum([
+      "relaxed",
+      "expanded_optional",
+      "requires_consent"
+    ]);
+    var ConsentFlowContractScopeValidator = external_exports.object({
+      area: external_exports.enum(["read", "write"]),
+      type: external_exports.enum(["credential", "personal"]),
+      key: external_exports.string(),
+      required: external_exports.boolean(),
+      reason: external_exports.string().optional()
+    });
+    var ConsentFlowContractDetailValueValidator = external_exports.union([
+      external_exports.string(),
+      external_exports.boolean(),
+      external_exports.string().array()
+    ]);
+    var ConsentFlowContractDetailChangeValidator = external_exports.object({
+      field: external_exports.enum([
+        "name",
+        "subtitle",
+        "description",
+        "reasonForAccessing",
+        "image",
+        "needsGuardianConsent",
+        "redirectUrl",
+        "frontDoorBoostUri",
+        "expiresAt",
+        "writers",
+        "autoboosts"
+      ]),
+      before: ConsentFlowContractDetailValueValidator.optional(),
+      after: ConsentFlowContractDetailValueValidator.optional()
+    });
+    var ConsentFlowContractDiffValidator = external_exports.object({
+      added: ConsentFlowContractScopeValidator.array(),
+      removed: ConsentFlowContractScopeValidator.array(),
+      changed: ConsentFlowContractScopeValidator.array(),
+      details: ConsentFlowContractDetailChangeValidator.array().optional()
+    });
+    var ConsentFlowContractUpdatePreviewValidator = external_exports.object({
+      headline: external_exports.string(),
+      subhead: external_exports.string(),
+      rows: external_exports.array(
+        external_exports.object({
+          scope: ConsentFlowContractScopeValidator,
+          change: external_exports.enum(["added", "removed", "changed"]),
+          label: external_exports.string(),
+          subtitle: external_exports.string()
+        })
+      ),
+      primaryLabel: external_exports.string()
+    });
+    var ConsentFlowContractStatusValidator = external_exports.enum(["active", "retired"]);
+    var ConsentFlowContractVersionValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      createdAt: external_exports.string(),
+      reason: external_exports.string().optional(),
+      kind: ConsentFlowContractChangeKindValidator.optional()
+    });
+    var ConsentFlowContractUpdateResultValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      kind: ConsentFlowContractChangeKindValidator,
+      affectedUsers: external_exports.number().int().nonnegative(),
+      preview: ConsentFlowContractUpdatePreviewValidator
+    });
+    var ConsentFlowConsentStatusValidator = external_exports.object({
+      status: ConsentFlowTermsStatusValidator.or(external_exports.literal("not_consented")),
+      consentedVersion: external_exports.number().int().positive().optional(),
+      currentVersion: external_exports.number().int().positive(),
+      needsReconsent: external_exports.boolean(),
+      reviewUrl: external_exports.string().optional()
+    });
+    var ConsentFlowContractNotificationDataValidator = external_exports.object({
+      contractUri: external_exports.string(),
+      contractName: external_exports.string().optional(),
+      fromVersion: external_exports.number().int().positive(),
+      toVersion: external_exports.number().int().positive(),
+      kind: ConsentFlowContractChangeKindValidator,
+      reason: external_exports.string().optional(),
+      diff: ConsentFlowContractDiffValidator,
+      reconsentDeadline: external_exports.string().optional(),
+      reviewUrl: external_exports.string(),
+      preview: ConsentFlowContractUpdatePreviewValidator.optional()
+    });
     var ConsentFlowContractValidator = external_exports.object({
       read: external_exports.object({
         anonymize: external_exports.boolean().optional(),
@@ -22593,13 +22846,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
             external_exports.string(),
             external_exports.object({
               required: external_exports.boolean(),
-              defaultEnabled: external_exports.boolean().optional()
+              defaultEnabled: external_exports.boolean().optional(),
+              reason: external_exports.string().optional()
             })
           ).default({})
         }).prefault({ categories: {} }),
         personal: external_exports.record(
           external_exports.string(),
-          external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+          external_exports.object({
+            required: external_exports.boolean(),
+            defaultEnabled: external_exports.boolean().optional(),
+            reason: external_exports.string().optional()
+          })
         ).default({})
       }).prefault({ credentials: { categories: {} }, personal: {} }),
       write: external_exports.object({
@@ -22608,16 +22866,55 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
             external_exports.string(),
             external_exports.object({
               required: external_exports.boolean(),
-              defaultEnabled: external_exports.boolean().optional()
+              defaultEnabled: external_exports.boolean().optional(),
+              reason: external_exports.string().optional()
             })
           ).default({})
         }).prefault({ categories: {} }),
         personal: external_exports.record(
           external_exports.string(),
-          external_exports.object({ required: external_exports.boolean(), defaultEnabled: external_exports.boolean().optional() })
+          external_exports.object({
+            required: external_exports.boolean(),
+            defaultEnabled: external_exports.boolean().optional(),
+            reason: external_exports.string().optional()
+          })
         ).default({})
       }).prefault({ credentials: { categories: {} }, personal: {} })
     });
+    var ConsentFlowContractScopePatchValidator = external_exports.object({
+      required: external_exports.boolean(),
+      defaultEnabled: external_exports.boolean().optional(),
+      reason: external_exports.string().optional()
+    }).nullable();
+    var ConsentFlowContractChangesValidator = external_exports.object({
+      contract: external_exports.object({
+        read: external_exports.object({
+          anonymize: external_exports.boolean().optional(),
+          credentials: external_exports.object({
+            categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+          }).optional(),
+          personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+        }).optional(),
+        write: external_exports.object({
+          credentials: external_exports.object({
+            categories: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+          }).optional(),
+          personal: external_exports.record(external_exports.string(), ConsentFlowContractScopePatchValidator).optional()
+        }).optional()
+      }).optional(),
+      name: external_exports.string().optional(),
+      subtitle: external_exports.string().optional(),
+      description: external_exports.string().optional(),
+      reasonForAccessing: external_exports.string().optional(),
+      image: external_exports.string().optional(),
+      needsGuardianConsent: external_exports.boolean().optional(),
+      redirectUrl: external_exports.string().optional(),
+      frontDoorBoostUri: external_exports.string().optional(),
+      expiresAt: external_exports.string().nullable().optional(),
+      autoboosts: AutoBoostConfigValidator.array().optional(),
+      writers: external_exports.string().array().optional(),
+      recipients: external_exports.string().array().optional()
+    });
     var ConsentFlowContractDetailsValidator = external_exports.object({
       contract: ConsentFlowContractValidator,
       owner: LCNProfileValidator,
@@ -22636,7 +22933,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       autoBoosts: external_exports.string().array().optional(),
       writers: external_exports.array(LCNProfileValidator).optional(),
       recipients: external_exports.array(LCNPublicProfileValidator.extend({ did: external_exports.string() })).optional(),
-      audienceVersion: external_exports.number().int().nonnegative().optional()
+      audienceVersion: external_exports.number().int().nonnegative().optional(),
+      version: external_exports.number().int().positive(),
+      status: ConsentFlowContractStatusValidator.optional(),
+      latestUpdate: external_exports.object({
+        fromVersion: external_exports.number().int().positive(),
+        toVersion: external_exports.number().int().positive(),
+        kind: ConsentFlowContractChangeKindValidator,
+        reason: external_exports.string().optional(),
+        diff: ConsentFlowContractDiffValidator,
+        reconsentDeadline: external_exports.string().optional(),
+        createdAt: external_exports.string(),
+        preview: ConsentFlowContractUpdatePreviewValidator
+      }).optional()
     });
     var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
     var ConsentFlowContractRequestReadStatusValidator = external_exports.enum(["unseen", "seen"]).nullable();
@@ -22725,7 +23034,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         contract: ConsentFlowContractDetailsValidator,
         uri: external_exports.string(),
         consenter: LCNProfileValidator,
-        status: ConsentFlowTermsStatusValidator
+        status: ConsentFlowTermsStatusValidator,
+        consentedVersion: external_exports.number().int().positive(),
+        lastReviewedVersion: external_exports.number().int().positive().optional(),
+        reconsentDeadline: external_exports.string().optional(),
+        newOptionsUntil: external_exports.string().optional(),
+        cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate
       }).array()
     });
     var ConsentFlowGuardianApprovalValidator = external_exports.object({
@@ -22801,7 +23115,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "update",
       "sync",
       "withdraw",
-      "write"
+      "write",
+      "reconsent"
     ]);
     var ConsentFlowTransactionsQueryValidator = external_exports.object({
       terms: ConsentFlowTermsQueryValidator.optional(),
@@ -22820,8 +23135,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       referral: ConsentFlowReferralValidator.optional(),
       id: external_exports.string(),
       action: ConsentFlowTransactionActionValidator,
+      kind: ConsentFlowContractChangeKindValidator.optional(),
       date: external_exports.string(),
-      uris: external_exports.string().array().optional()
+      uris: external_exports.string().array().optional(),
+      consentedVersion: external_exports.number().int().positive().optional(),
+      reconsentDeadline: external_exports.string().optional(),
+      newOptionsUntil: external_exports.string().optional()
     });
     var HolderExportConsentRecordValidator = external_exports.object({
       termsUri: external_exports.string(),
@@ -22829,6 +23148,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contract: ConsentFlowContractDetailsValidator,
       terms: ConsentFlowTermsValidator,
       referral: ConsentFlowReferralValidator.optional(),
+      consentedVersion: external_exports.number().int().positive(),
+      reconsentDeadline: external_exports.string().optional(),
+      newOptionsUntil: external_exports.string().optional(),
+      cumulativeUpdate: ConsentFlowContractDetailsValidator.shape.latestUpdate,
       transactions: ConsentFlowTransactionValidator.array()
     });
     var HolderExportMetadataValidator = external_exports.object({
@@ -22889,10 +23212,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "GUARDIAN_APPROVED",
       "GUARDIAN_REJECTED",
       "APP_NOTIFICATION",
+      "ANNOUNCEMENT",
       "CREDENTIAL_REVOKED",
       "CREDENTIAL_SUSPENDED",
       "CREDENTIAL_UNSUSPENDED",
-      "CREDENTIAL_REFRESHED"
+      "CREDENTIAL_REFRESHED",
+      "CONSENT_FLOW_CONTRACT_UPDATED"
     ]);
     var LCNNotificationMessageValidator = external_exports.object({
       title: external_exports.string().optional(),
@@ -22921,12 +23246,26 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       timestamp: external_exports.iso.datetime().optional()
     });
     var LCNNotificationMetadataValidator = external_exports.object({
-      connectionPrompt: LCNConnectionPromptMetadataValidator.optional()
+      connectionPrompt: LCNConnectionPromptMetadataValidator.optional(),
+      campaignId: external_exports.string().regex(/^[a-z0-9-]{3,64}$/).optional(),
+      campaignCreatedAt: external_exports.iso.datetime().optional(),
+      campaignHasInApp: external_exports.boolean().optional(),
+      campaignTestId: external_exports.uuid().optional()
     }).catchall(external_exports.unknown());
     var LCNNotificationDataValidator = external_exports.object({
       vcUris: external_exports.array(external_exports.string()).optional(),
       vpUris: external_exports.array(external_exports.string()).optional(),
       transaction: ConsentFlowTransactionValidator.optional(),
+      contractUri: external_exports.string().optional(),
+      contractName: external_exports.string().optional(),
+      fromVersion: external_exports.number().int().positive().optional(),
+      toVersion: external_exports.number().int().positive().optional(),
+      kind: ConsentFlowContractChangeKindValidator.optional(),
+      reason: external_exports.string().optional(),
+      diff: ConsentFlowContractDiffValidator.optional(),
+      reconsentDeadline: external_exports.string().optional(),
+      reviewUrl: external_exports.string().optional(),
+      preview: ConsentFlowContractUpdatePreviewValidator.optional(),
       inbox: LCNNotificationInboxValidator.optional(),
       metadata: LCNNotificationMetadataValidator.optional()
     }).loose();
@@ -24039,29 +24378,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
        */
       wrongAttempts: external_exports.number().int().nonnegative().optional()
     });
-    var BITSTRING_STATUS_PURPOSES = ["revocation", "suspension"];
-    var DEFAULT_BITSTRING_STATUS_LIST_SIZE = 131072;
-    var BitstringStatusPurposeValidator = external_exports.enum(BITSTRING_STATUS_PURPOSES);
-    var BitstringStatusListEntryValidator = external_exports.object({
-      id: external_exports.string().optional(),
-      type: external_exports.literal("BitstringStatusListEntry"),
-      statusPurpose: BitstringStatusPurposeValidator,
-      statusListIndex: external_exports.string().or(external_exports.number().int().nonnegative()),
-      statusListCredential: external_exports.string()
-    });
-    var AllocatedBitstringStatusListEntryValidator = BitstringStatusListEntryValidator.extend({
-      id: external_exports.string()
-    });
-    var BitstringStatusListCredentialSubjectValidator = external_exports.object({
-      id: external_exports.string().optional(),
-      type: external_exports.literal("BitstringStatusList"),
-      statusPurpose: BitstringStatusPurposeValidator,
-      encodedList: external_exports.string()
-    });
-    var AllocateCredentialStatusInputValidator = external_exports.object({
-      statusPurposes: external_exports.array(BitstringStatusPurposeValidator).optional(),
-      listSize: external_exports.number().int().positive().optional()
-    }).default({});
     var isSafeInAppMessagePath = /* @__PURE__ */ __name2((path) => {
       let decoded = path;
       for (let depth = 0; depth < 5; depth += 1) {
@@ -24389,24 +24705,46 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }, "parseInAppMessagesFlag");
     var CampaignIdValidator = external_exports.string().regex(/^[a-z0-9-]{3,64}$/);
     var CampaignStatusValidator = external_exports.enum(["draft", "live", "paused", "archived"]);
-    var CampaignChannelValidator = external_exports.enum(["inApp", "notify"]);
+    var CampaignChannelValidator = external_exports.enum(["inApp", "notify", "email"]);
     var CampaignEventValidator = external_exports.enum(["shown", "clicked", "dismissed", "converted"]);
-    var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => new Date(value).toISOString());
+    var timestamp = external_exports.iso.datetime({ offset: true }).overwrite((value) => {
+      const date5 = new Date(value);
+      return Number.isFinite(date5.getTime()) ? date5.toISOString() : value;
+    });
     var notification = external_exports.object({ title: external_exports.string().min(1), body: external_exports.string().min(1) }).strict();
-    var channels = external_exports.array(CampaignChannelValidator).min(1).max(2).refine((values) => new Set(values).size === values.length, "Channels must be unique");
+    var CampaignEmailValidator = external_exports.object({
+      subject: external_exports.string().trim().min(1).max(200).regex(/^[^\r\n]+$/),
+      title: external_exports.string().trim().min(1).max(200),
+      body: external_exports.string().trim().min(1).max(2e4),
+      heroImageUrl: external_exports.url().startsWith("https://").max(2048).optional(),
+      ctaLabel: external_exports.string().trim().min(1).max(100)
+    }).strict();
+    var AnnouncementPreferencesValidator = external_exports.object({
+      announcementEmailOptOut: external_exports.boolean(),
+      announcementPushOptOut: external_exports.boolean()
+    }).strict();
+    var channels = external_exports.array(CampaignChannelValidator).min(1).max(3).refine((values) => new Set(values).size === values.length, "Channels must be unique");
     var campaignDefinition = external_exports.object({
       id: CampaignIdValidator,
       name: external_exports.string().trim().min(1).max(200),
       status: CampaignStatusValidator.default("draft"),
       channels,
-      message: inAppMessageValidator,
+      message: inAppMessageValidator.optional(),
       notification: notification.optional(),
+      email: CampaignEmailValidator.optional(),
       startsAt: timestamp.optional(),
       endsAt: timestamp.optional(),
       excludeMinors: external_exports.boolean().default(true),
       selfEnroll: external_exports.boolean().default(false)
     }).strict();
     var validDefinition = /* @__PURE__ */ __name2((value, ctx) => {
+      if (value.channels.includes("inApp") && !value.message) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["message"],
+          message: "In-app requires a message"
+        });
+      }
       if (value.channels.includes("notify") && !value.notification) {
         ctx.addIssue({
           code: "custom",
@@ -24414,15 +24752,23 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           message: "Notify requires a title and body"
         });
       }
+      if (value.channels.includes("email") && !value.email) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["email"],
+          message: "Email requires announcement content"
+        });
+      }
       if (value.startsAt && value.endsAt && value.startsAt >= value.endsAt) {
         ctx.addIssue({ code: "custom", path: ["endsAt"], message: "End must be after start" });
       }
     }, "validDefinition");
     var CampaignValidator = campaignDefinition.extend({
+      tenantId: external_exports.string().optional(),
       createdAt: timestamp,
       updatedAt: timestamp
     }).superRefine(validDefinition).superRefine((value, ctx) => {
-      if (value.message.id !== value.id) {
+      if (value.message && value.message.id !== value.id) {
         ctx.addIssue({
           code: "custom",
           path: ["message", "id"],
@@ -24431,21 +24777,23 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
     });
     var CreateCampaignInputValidator = campaignDefinition.extend({
-      message: inAppMessageAuthoringValidator
+      message: inAppMessageAuthoringValidator.optional()
     }).superRefine(validDefinition);
     var CampaignUpdatesValidator = campaignDefinition.omit({ id: true }).partial().extend({
       // A PATCH must not apply creation defaults to fields the caller omitted.
       status: CampaignStatusValidator.optional(),
       excludeMinors: external_exports.boolean().optional(),
       selfEnroll: external_exports.boolean().optional(),
-      message: inAppMessageAuthoringValidator.optional(),
+      message: inAppMessageAuthoringValidator.nullable().optional(),
       notification: notification.nullable().optional(),
+      email: CampaignEmailValidator.nullable().optional(),
       startsAt: timestamp.nullable().optional(),
       endsAt: timestamp.nullable().optional()
     }).strict();
     var UpdateCampaignInputValidator = external_exports.object({
       campaignId: CampaignIdValidator,
-      updates: CampaignUpdatesValidator
+      updates: CampaignUpdatesValidator,
+      expectedUpdatedAt: timestamp.optional()
     }).strict();
     var identifier = external_exports.string().trim().min(1).max(2048);
     var metadataKey = external_exports.string().regex(/^[a-zA-Z_][a-zA-Z0-9_.-]{0,63}$/).refine(
@@ -24497,7 +24845,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       clickedAt: timestamp.optional(),
       dismissedAt: timestamp.optional(),
       convertedAt: timestamp.optional(),
-      notifiedAt: timestamp.optional()
+      notifiedAt: timestamp.optional(),
+      emailedAt: timestamp.optional()
     });
     var MyCampaignValidator = external_exports.object({
       campaign: campaignDefinition.pick({
@@ -24506,12 +24855,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         startsAt: true,
         endsAt: true,
         selfEnroll: true
-      }),
-      state: CampaignUserStateValidator
+      }).extend({ message: inAppMessageValidator }),
+      state: CampaignUserStateValidator,
+      testId: external_exports.uuid().optional()
+    });
+    var CampaignTestValidator = external_exports.object({
+      id: external_exports.uuid(),
+      campaignId: CampaignIdValidator,
+      message: inAppMessageValidator
     });
     var CampaignStatsValidator = external_exports.object({
       audience: external_exports.number().int().nonnegative(),
       notified: external_exports.number().int().nonnegative(),
+      emailed: external_exports.number().int().nonnegative(),
       shown: external_exports.number().int().nonnegative(),
       clicked: external_exports.number().int().nonnegative(),
       dismissed: external_exports.number().int().nonnegative(),
@@ -24538,6 +24894,31 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       hasMore: external_exports.boolean(),
       cursor: external_exports.string().optional()
     });
+    var CampaignDispatchPreviewValidator = external_exports.object({
+      campaignId: CampaignIdValidator,
+      audienceCount: external_exports.number().int().nonnegative(),
+      alreadyNotifiedCount: external_exports.number().int().nonnegative(),
+      recipientCount: external_exports.number().int().nonnegative(),
+      notificationRecipientCount: external_exports.number().int().nonnegative().optional(),
+      emailRecipientCount: external_exports.number().int().nonnegative().optional(),
+      previewToken: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      blockedReason: external_exports.enum([
+        "not_live",
+        "notify_disabled",
+        "email_confirmation_required",
+        "not_started",
+        "ended",
+        "no_recipients"
+      ]).optional()
+    });
+    var CampaignDispatchOptionsValidator = external_exports.object({
+      expectedPreviewToken: CampaignDispatchPreviewValidator.shape.previewToken.optional()
+    }).strict();
+    var CampaignAudienceResultValidator = external_exports.object({
+      count: external_exports.number().int().nonnegative(),
+      added: external_exports.number().int().nonnegative(),
+      notFound: external_exports.array(external_exports.string())
+    });
     var SHARE_LINK_ID_BYTES = 16;
     var SHARE_CONTENT_KEY_BYTES = 32;
     var SHARE_IV_BYTES = 12;
@@ -25062,6 +25443,217 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
     );
     var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
+    var RoleValidator = external_exports.enum(["user", "assistant", "tool", "system"]);
+    var AiSessionMode = {
+      tutor: "ai-tutor",
+      insights: "ai-insights"
+    };
+    var AiSessionModeValidator = external_exports.enum([AiSessionMode.tutor, AiSessionMode.insights]);
+    var StructuredResponseValidator = external_exports.object({
+      notes: external_exports.string().optional(),
+      questions: external_exports.array(external_exports.string())
+    });
+    var IntroStreamModeValidator = external_exports.enum(["formatted", "structured"]);
+    var ChatMessageValidator = external_exports.object({
+      role: RoleValidator,
+      content: external_exports.string().nullable(),
+      tool_call_id: external_exports.string().optional(),
+      tool_calls: external_exports.array(
+        external_exports.object({
+          id: external_exports.string(),
+          type: external_exports.literal("function"),
+          function: external_exports.object({
+            name: external_exports.string(),
+            arguments: external_exports.string()
+          })
+        })
+      ).optional()
+    });
+    var InsightArtifactValidator = external_exports.object({
+      title: external_exports.string(),
+      summary: external_exports.string(),
+      category: external_exports.string(),
+      question: external_exports.string(),
+      narrative: external_exports.string()
+    });
+    var ArtifactSuggestionValidator = external_exports.object({
+      artifact: InsightArtifactValidator,
+      source_text: external_exports.string().optional(),
+      created_at: external_exports.string()
+    });
+    var ThreadCredentialContextValidator = external_exports.object({
+      uri: external_exports.string(),
+      type: external_exports.string(),
+      context: external_exports.string(),
+      score: external_exports.number(),
+      strongestScore: external_exports.number().optional(),
+      averageScore: external_exports.number().optional(),
+      matchCount: external_exports.number().optional(),
+      title: external_exports.string().optional()
+    });
+    var ThreadValidator = external_exports.object({
+      id: external_exports.string(),
+      did: external_exports.string(),
+      topicCredentialUri: external_exports.string().nullable().optional(),
+      title: external_exports.string(),
+      created_at: external_exports.string(),
+      last_message_at: external_exports.string(),
+      active: external_exports.boolean().optional(),
+      ended_at: external_exports.string().optional(),
+      plan_started_at: external_exports.string().optional(),
+      summaries: external_exports.array(
+        external_exports.object({
+          summary_data: external_exports.string(),
+          credential_uri: external_exports.string(),
+          created_at: external_exports.string()
+        })
+      ).optional(),
+      plans: external_exports.array(
+        external_exports.object({
+          plan_data: external_exports.string(),
+          created_at: external_exports.string(),
+          consentRevision: external_exports.string().optional()
+        })
+      ).optional(),
+      credentials: external_exports.array(ThreadCredentialContextValidator).optional(),
+      credentialSearchTopic: external_exports.string().optional(),
+      credentialContextStatus: external_exports.enum(["pending", "ready", "empty", "error"]).optional(),
+      mode: AiSessionModeValidator.optional(),
+      artifactSuggestions: external_exports.array(ArtifactSuggestionValidator).optional()
+    });
+    var CredentialVerificationMetadataValidator = external_exports.object({
+      credentialUri: external_exports.string(),
+      contentHash: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      status: external_exports.enum(["valid", "invalid"]),
+      checkedAt: external_exports.string().datetime(),
+      verifier: external_exports.object({
+        name: external_exports.string(),
+        version: external_exports.string()
+      }),
+      verifiedPayload: external_exports.enum(["credential", "boostCredential"]),
+      checks: external_exports.array(external_exports.string()),
+      errors: external_exports.array(external_exports.string()),
+      warnings: external_exports.array(external_exports.string()),
+      provenance: external_exports.object({
+        source: external_exports.enum(["wallet", "generated"]),
+        retrievedAt: external_exports.string().datetime()
+      }),
+      consent: external_exports.object({
+        contractUri: external_exports.string(),
+        receiptId: external_exports.string().min(1),
+        grantedAt: external_exports.string().datetime().optional(),
+        updatedAt: external_exports.string().datetime(),
+        contractUpdatedAt: external_exports.string().min(1),
+        status: external_exports.literal("live"),
+        expiresAt: external_exports.string().datetime().optional(),
+        contractExpiresAt: external_exports.string().datetime().optional(),
+        categories: external_exports.array(external_exports.string()),
+        credentialUris: external_exports.array(external_exports.string()),
+        personalFields: external_exports.array(external_exports.string()),
+        purpose: external_exports.enum(["credential-ingestion", "model-inference", "embedding"]),
+        revision: external_exports.string().min(1),
+        guardian: external_exports.object({ required: external_exports.boolean(), approved: external_exports.boolean() })
+      })
+    });
+    var ModelSafeCredentialFactValidator = external_exports.object({
+      kind: external_exports.enum([
+        "skill",
+        "goal",
+        "achievement",
+        "course",
+        "experience",
+        "competency",
+        "title",
+        "summary",
+        "assessment",
+        "grade",
+        "date",
+        "alignment",
+        "criteria",
+        "pathway",
+        "topic"
+      ]),
+      value: external_exports.string().min(1).max(240),
+      label: external_exports.string().min(1).max(120).optional()
+    });
+    var ModelSafeCredentialProjectionValidator = external_exports.object({
+      schemaVersion: external_exports.literal("1"),
+      category: external_exports.string().min(1).max(120),
+      credentialTypes: external_exports.array(external_exports.string().min(1).max(120)).max(20),
+      facts: external_exports.array(ModelSafeCredentialFactValidator).max(100),
+      // Present only on credentials that are past their expiry, so the model can
+      // tell a lapsed credential from a current one.
+      expired: external_exports.literal(true).optional(),
+      expirationDate: external_exports.string().datetime().optional()
+    });
+    var AIPassportCredentialRecordValidator = external_exports.object({
+      id: external_exports.string(),
+      uri: external_exports.string(),
+      category: external_exports.string(),
+      credential: VCValidator,
+      aiContext: external_exports.string(),
+      generalSummary: external_exports.string().optional(),
+      createdAt: external_exports.string(),
+      verification: CredentialVerificationMetadataValidator.optional(),
+      projection: ModelSafeCredentialProjectionValidator.optional()
+    });
+    var AuthenticatedMessageValidator = external_exports.object({
+      message: ChatMessageValidator.optional(),
+      threadId: external_exports.string().optional(),
+      selectedQuestion: external_exports.string().optional(),
+      action: external_exports.enum([
+        "start_topic",
+        "continue_plan",
+        "start_topic_uri",
+        "start_learning_pathway",
+        "start_insights_session",
+        "close_insights_session",
+        "artifact_suggestion"
+      ]).optional(),
+      topic: external_exports.string().optional(),
+      topicUri: external_exports.string().optional(),
+      pathwayUri: external_exports.string().optional(),
+      mode: AiSessionModeValidator.optional(),
+      introStreamMode: IntroStreamModeValidator.optional(),
+      // BCP-47 language for AI responses (LC-1901). This has to live on the
+      // validator, not just the inferred type — z.object strips unknown keys, so an
+      // undeclared `locale` would be dropped before the WS handler ever saw it.
+      locale: external_exports.string().nullish()
+    });
+    var DebugInfoValidator = external_exports.object({
+      operation: external_exports.string(),
+      collection: external_exports.string(),
+      input: external_exports.unknown().optional(),
+      output: external_exports.unknown().optional(),
+      timestamp: external_exports.string(),
+      duration: external_exports.number().optional()
+    });
+    var TimingEventValidator = external_exports.object({
+      event: external_exports.literal("timing"),
+      operation: external_exports.string(),
+      phase: external_exports.enum(["start", "end", "complete"]),
+      duration: external_exports.number().optional(),
+      metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      timestamp: external_exports.string()
+    });
+    var LearningPathwayValidator = external_exports.object({
+      id: external_exports.string(),
+      learningPathway: external_exports.object({
+        stepIndex: external_exports.number(),
+        step: external_exports.object({
+          title: external_exports.string(),
+          description: external_exports.string(),
+          summary: external_exports.string(),
+          learned: external_exports.array(external_exports.string()),
+          skills: external_exports.array(
+            external_exports.object({
+              title: external_exports.string(),
+              description: external_exports.string()
+            })
+          )
+        })
+      })
+    });
   }
 });
 
@@ -25087,12 +25679,14 @@ __export(index_exports, {
   EMAIL_RELAY_ALGORITHM: () => EMAIL_RELAY_ALGORITHM,
   EMAIL_RELAY_ENVELOPE_VERSION: () => EMAIL_RELAY_ENVELOPE_VERSION,
   ESCROW_ALGORITHM: () => ESCROW_ALGORITHM,
+  ESCROW_AUTHORITY_TENANT_PATTERN: () => ESCROW_AUTHORITY_TENANT_PATTERN,
   ESCROW_BLOB_INFO: () => ESCROW_BLOB_INFO,
   ESCROW_CLIENT_KEY_ID: () => ESCROW_CLIENT_KEY_ID,
   ESCROW_ENROLLMENT_INTENT_DOMAIN: () => ESCROW_ENROLLMENT_INTENT_DOMAIN,
   ESCROW_ENVELOPE_VERSION: () => ESCROW_ENVELOPE_VERSION,
   ESCROW_PIN_MAX_ATTEMPTS: () => ESCROW_PIN_MAX_ATTEMPTS,
   ESCROW_RELEASE_INFO: () => ESCROW_RELEASE_INFO,
+  EscrowAuthorityTenantMismatchError: () => EscrowAuthorityTenantMismatchError,
   EscrowEvidenceError: () => EscrowEvidenceError,
   EscrowHoldRestartThrottledError: () => EscrowHoldRestartThrottledError,
   EscrowPinLockedError: () => EscrowPinLockedError,
@@ -25101,6 +25695,8 @@ __export(index_exports, {
   EscrowPinUnavailableError: () => EscrowPinUnavailableError,
   EscrowRequestError: () => EscrowRequestError,
   IdentityRecoverySessionConsumedError: () => IdentityRecoverySessionConsumedError,
+  MAX_ESCROW_EMAIL_BRAND_DIGITS: () => MAX_ESCROW_EMAIL_BRAND_DIGITS,
+  MAX_ESCROW_EMAIL_BRAND_LENGTH: () => MAX_ESCROW_EMAIL_BRAND_LENGTH,
   NitroAttestationError: () => NitroAttestationError,
   PIN_MAX_LENGTH: () => PIN_MAX_LENGTH,
   PIN_MIN_LENGTH: () => PIN_MIN_LENGTH,
@@ -25118,6 +25714,7 @@ __export(index_exports, {
   bufferToBase64: () => bufferToBase64,
   buildRecoveryPhraseChallengeOptions: () => buildRecoveryPhraseChallengeOptions,
   bytesToHex: () => bytesToHex,
+  canonicalEscrowEmailBrand: () => canonicalEscrowEmailBrand,
   clearAllShares: () => clearAllShares,
   constantTimeEqualHex: () => constantTimeEqualHex,
   countWords: () => countWords,
@@ -26508,6 +27105,16 @@ var ESCROW_BLOB_INFO = "learncard-escrow-blob-v1";
 var ESCROW_RELEASE_INFO = "learncard-escrow-release-v1";
 var ESCROW_CLIENT_KEY_ID = "client";
 var RECOVERY_LANGUAGES = ["en", "es", "fr", "ar"];
+var MAX_ESCROW_EMAIL_BRAND_LENGTH = 32;
+var MAX_ESCROW_EMAIL_BRAND_DIGITS = 3;
+var canonicalEscrowEmailBrand = /* @__PURE__ */ __name((raw) => {
+  if (typeof raw !== "string") return void 0;
+  const brand = raw.split(" ").filter((word) => word.length > 0).join(" ");
+  if (brand.length === 0 || brand.length > MAX_ESCROW_EMAIL_BRAND_LENGTH || !/^[A-Za-z][A-Za-z0-9 '&-]*$/.test(brand) || (brand.match(/[0-9]/g)?.length ?? 0) > MAX_ESCROW_EMAIL_BRAND_DIGITS || /http|www/i.test(brand)) {
+    return void 0;
+  }
+  return brand;
+}, "canonicalEscrowEmailBrand");
 var encodeUtf82 = /* @__PURE__ */ __name((value) => {
   const bytes3 = new TextEncoder().encode(value);
   const copy = new Uint8Array(new ArrayBuffer(bytes3.byteLength));
@@ -26563,6 +27170,7 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
     }
     recoveryContact = { recoveryEmail: email, recoveryLanguage: language };
   }
+  const recoveryBrand = canonicalEscrowEmailBrand(value.recoveryBrand);
   return {
     version: ESCROW_ENVELOPE_VERSION,
     recoveryShare: requireString2(value, "recoveryShare", {
@@ -26579,7 +27187,8 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
         pattern: /^[0-9a-f]{64}$/i
       }).toLowerCase()
     } : {},
-    ...recoveryContact
+    ...recoveryContact,
+    ...recoveryBrand !== void 0 ? { recoveryBrand } : {}
   };
 }, "parseEscrowBlobPlaintext");
 var parseEscrowReleasePlaintext = /* @__PURE__ */ __name((value) => {
@@ -27148,6 +27757,30 @@ var wNAF = /* @__PURE__ */ __name((n) => {
   return { p, f };
 }, "wNAF");
 
+// src/escrow-authority.types.ts
+var EscrowEvidenceError = class extends Error {
+  static {
+    __name(this, "EscrowEvidenceError");
+  }
+  constructor() {
+    super("Automatic recovery evidence could not be verified.");
+    this.name = "EscrowEvidenceError";
+  }
+};
+var ESCROW_AUTHORITY_TENANT_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var EscrowAuthorityTenantMismatchError = class extends EscrowEvidenceError {
+  static {
+    __name(this, "EscrowAuthorityTenantMismatchError");
+  }
+  constructor(expectedTenant, signedTenant) {
+    super();
+    this.name = "EscrowAuthorityTenantMismatchError";
+    this.expectedTenant = expectedTenant;
+    this.signedTenant = signedTenant;
+    this.message = `Escrow authority tenant mismatch: the enclave signed for "${signedTenant}" but this app expects "${expectedTenant}". Set auth.sss.escrowAuthorityTenant to the enclave's ESCROW_AUTHORITY_TENANT.`;
+  }
+};
+
 // src/escrow-enrollment-intent.ts
 var ESCROW_ENROLLMENT_INTENT_DOMAIN = "learncard-escrow-enrollment-intent-v2\0";
 var BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
@@ -27228,7 +27861,7 @@ var encodeEscrowEnrollmentIntent = /* @__PURE__ */ __name((intent) => {
     Object.keys(intent).length === FIELDS.length && FIELDS.every((field) => Object.prototype.hasOwnProperty.call(intent, field))
   );
   requireIntent(intent.version === 2 && typeof intent.allowRewrap === "boolean");
-  requireIntent(matches(intent.tenant, /^[A-Za-z0-9_-]{1,128}$/));
+  requireIntent(matches(intent.tenant, ESCROW_AUTHORITY_TENANT_PATTERN));
   requireIntent(matches(intent.authorityGeneration, /^[A-Za-z0-9_-]{1,128}$/));
   requireIntent(matches(intent.requestId, /^[A-Za-z0-9._-]{1,112}$/));
   didPublicKey(intent.did);
@@ -29694,17 +30327,6 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
   };
 }, "verifyEnclaveAttestation");
 
-// src/escrow-authority.types.ts
-var EscrowEvidenceError = class extends Error {
-  static {
-    __name(this, "EscrowEvidenceError");
-  }
-  constructor() {
-    super("Automatic recovery evidence could not be verified.");
-    this.name = "EscrowEvidenceError";
-  }
-};
-
 // src/escrow-authority.ts
 var fail2 = /* @__PURE__ */ __name(() => {
   throw new EscrowEvidenceError();
@@ -29743,6 +30365,12 @@ var verifyEscrowCodeDelivery = /* @__PURE__ */ __name(async (delivery, expected,
 var requireEvidence = /* @__PURE__ */ __name((condition) => {
   if (!condition) fail2();
 }, "requireEvidence");
+var requireAuthorityTenant = /* @__PURE__ */ __name((signedTenant, expectedTenant) => {
+  if (signedTenant === expectedTenant) return;
+  if (typeof signedTenant === "string" && ESCROW_AUTHORITY_TENANT_PATTERN.test(signedTenant))
+    throw new EscrowAuthorityTenantMismatchError(expectedTenant, signedTenant);
+  fail2();
+}, "requireAuthorityTenant");
 var object = /* @__PURE__ */ __name((value) => {
   if (!value || typeof value !== "object" || Array.isArray(value)) return fail2();
   return value;
@@ -29935,7 +30563,8 @@ var verifyEscrowAuthorityState = /* @__PURE__ */ __name(async (response, nonce,
   const { payload } = await verifyRecord(raw.proof, "snapshot", identity);
   if (!Array.isArray(payload) || payload.length !== 2 || payload[0] !== nonce) return fail2();
   const signed = state(payload[1]);
-  requireEvidence(signed.tenant === tenant && signed.did === did);
+  requireEvidence(signed.did === did);
+  requireAuthorityTenant(signed.tenant, tenant);
   requireEvidence(JSON.stringify(signed) === JSON.stringify(state(raw.state)));
   if (signed.envelope) {
     requireEvidence(
@@ -30025,7 +30654,8 @@ var verifyEscrowHoldRecord = /* @__PURE__ */ __name(async (record, expected, ide
   keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
   const binding = object(commit.binding);
   keys(binding, ["tenant", "generation", "didHash"]);
-  requireEvidence(commit.schemaVersion === 1 && binding.tenant === expected.tenant);
+  requireEvidence(commit.schemaVersion === 1);
+  requireAuthorityTenant(binding.tenant, expected.tenant);
   const authorityGeneration = text(binding.generation, 128);
   if (historical) requireEvidence(authorityGeneration === historical.authorityGeneration);
   requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(expected.did)));
@@ -30074,7 +30704,7 @@ var resolveEscrowEnrollmentAction = /* @__PURE__ */ __name((current, input) => {
   const action = disabling ? "disable" : current.status !== "active" ? "enroll" : current.hasPin && pinAction === "keep" ? "carry" : "replace";
   return { action, pinAction, bindsRecoveryContact: action === "enroll" || action === "replace" };
 }, "resolveEscrowEnrollmentAction");
-var violatesCarryContactRule = /* @__PURE__ */ __name((action, target) => action === "carry" && !!target && (!!target.recoveryEmail || !!target.recoveryLanguage), "violatesCarryContactRule");
+var violatesCarryContactRule = /* @__PURE__ */ __name((action, target) => action === "carry" && !!target && (!!target.recoveryEmail || !!target.recoveryLanguage || !!target.recoveryBrand), "violatesCarryContactRule");
 var createEscrowEnrollmentIntent = /* @__PURE__ */ __name(async (input) => {
   const current = state(input.state);
   const target = input.target === null ? null : envelope(input.target);
@@ -30428,6 +31058,7 @@ var EscrowRequestError = class extends Error {
     __name(this, "EscrowRequestError");
   }
 };
+var isConflictRefusal = /* @__PURE__ */ __name((error) => error instanceof EscrowRequestError && error.status === 409, "isConflictRefusal");
 var DuplicateShareCoordinateError = class extends Error {
   static {
     __name(this, "DuplicateShareCoordinateError");
@@ -30871,6 +31502,16 @@ function createSSSStrategy(config) {
     emailBranding,
     tenantId
   } = config;
+  const authorityTenant = config.escrow?.authorityTenant ?? tenantId ?? "learncard";
+  if (config.escrow && !ESCROW_AUTHORITY_TENANT_PATTERN.test(authorityTenant))
+    throw new Error(
+      'Invalid escrow authority tenant: expected 1-128 letters, digits, "_" or "-".'
+    );
+  const emailBrand = config.escrow?.emailBrand === void 0 ? void 0 : canonicalEscrowEmailBrand(config.escrow.emailBrand);
+  if (config.escrow?.emailBrand !== void 0 && emailBrand === void 0)
+    throw new Error(
+      `Invalid escrow email brand: expected 1-32 ASCII letters, digits, spaces, "-", "'" or "&", starting with a letter.`
+    );
   const storage = config.storage || defaultStorage;
   let storageGeneration = 0;
   const localWrites = /* @__PURE__ */ new Set();
@@ -30990,7 +31631,7 @@ function createSSSStrategy(config) {
     return result.hold;
   }, "fetchEscrowHoldStatus");
   const recoveryExpectations = /* @__PURE__ */ __name((holdId, expected) => {
-    if (!expected || expected.holdId !== holdId || expected.tenant !== (tenantId ?? "learncard") || !expected.did || !expected.clientEphemeralPublicKey || !expected.blobHash || !expected.authorityGeneration || !expected.holdDigest || !expected.ledgerPublicKey || !expected.keyId)
+    if (!expected || expected.holdId !== holdId || expected.tenant !== authorityTenant || !expected.did || !expected.clientEphemeralPublicKey || !expected.blobHash || !expected.authorityGeneration || !expected.holdDigest || !expected.ledgerPublicKey || !expected.keyId)
       throw new EscrowEvidenceError();
     return { ...expected };
   }, "recoveryExpectations");
@@ -31025,7 +31666,7 @@ function createSSSStrategy(config) {
     const result = await verifyEscrowAuthorityState(
       response,
       nonce,
-      tenantId ?? "learncard",
+      authorityTenant,
       did,
       identity
     );
@@ -31057,7 +31698,14 @@ function createSSSStrategy(config) {
         did: primaryDid,
         shareVersion,
         ...pinMaterial ? { pinVerifier: pinMaterial.pinVerifier } : {},
-        ...authority && recoveryEmail && bindsRecoveryContact ? { recoveryEmail, recoveryLanguage } : {}
+        // D21: the brand is sealed exactly when the contact is, so a
+        // carry (whose target the enclave refuses if it claims one)
+        // never sends it; the enclave inherits the source's brand.
+        ...authority && recoveryEmail && bindsRecoveryContact ? {
+          recoveryEmail,
+          recoveryLanguage,
+          ...emailBrand ? { recoveryBrand: emailBrand } : {}
+        } : {}
       },
       publicKey,
       keyId
@@ -31324,21 +31972,34 @@ function createSSSStrategy(config) {
       }
     };
   }, "captureActiveUserGuard");
-  const pinHasRecordedWrongAttempts = /* @__PURE__ */ __name((escrowPin) => {
+  const recordedWrongPinAttempts = /* @__PURE__ */ __name((escrowPin) => {
     const status = escrowPin;
-    if (status?.state === "none") return false;
-    return typeof status?.wrongAttempts !== "number" || status.wrongAttempts > 0;
-  }, "pinHasRecordedWrongAttempts");
-  const refreshablePinCharges = /* @__PURE__ */ __name((before, after) => {
+    if (status?.state === "none") return 0;
+    const count = status?.wrongAttempts;
+    return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
+  }, "recordedWrongPinAttempts");
+  const attemptCount = /* @__PURE__ */ __name((value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0, "attemptCount");
+  const pinSignInClean = /* @__PURE__ */ __name((observed, flowAttempts) => {
+    const flowSalt = flowAttempts?.pinSalt;
+    const sameGeneration = typeof flowSalt !== "string" || observed.every((status) => {
+      const salt = status?.salt;
+      return typeof salt !== "string" || salt === flowSalt;
+    });
+    const attempts = sameGeneration ? flowAttempts : void 0;
+    const own = attempts ? attemptCount(attempts.ownWrongAttempts) : 0;
+    if (own === void 0) return { clean: false, ownWrongAttempts: 0 };
+    const prior = attempts ? attemptCount(attempts.priorWrongAttempts) : recordedWrongPinAttempts(observed[0]);
+    const clean = prior === 0 && observed.length > 0 && observed.every((status) => recordedWrongPinAttempts(status) === own);
+    return { clean, ownWrongAttempts: own };
+  }, "pinSignInClean");
+  const refreshablePinCharges = /* @__PURE__ */ __name((before, after, ownWrongAttempts) => {
     const pre = before;
     const post = after;
-    if (pinHasRecordedWrongAttempts(before) || pinHasRecordedWrongAttempts(after))
-      return void 0;
     if (pre?.state !== "enabled" || post?.state !== "enabled") return void 0;
     if (typeof pre.attemptsRemaining !== "number" || typeof post.attemptsRemaining !== "number")
       return void 0;
     if (post.attemptsRemaining !== pre.attemptsRemaining - 1) return void 0;
-    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: 0 };
+    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: ownWrongAttempts };
   }, "refreshablePinCharges");
   const freshPinMaterial = /* @__PURE__ */ __name(async (pin) => {
     if (!validatePin(pin).ok) return void 0;
@@ -31361,7 +32022,7 @@ function createSSSStrategy(config) {
       primaryDid: released.primaryDid
     };
   }, "adoptReleasedShare");
-  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore) => {
+  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore, pinAttempts) => {
     const storage2 = guardedStorage();
     const generation = storageGeneration;
     const storageId = activeStorageId;
@@ -31370,7 +32031,11 @@ function createSSSStrategy(config) {
         throw new Error("This recovery request was cancelled.");
       }
     }, "assertActive");
-    const { mode, newPinRequired, refreshCharges } = await withShareUpdateLock(
+    const {
+      mode,
+      newPinRequired: newPinRequiredAtRelease,
+      refreshCharges
+    } = await withShareUpdateLock(
       storage2,
       storageId,
       () => withRotationLock(async () => {
@@ -31414,18 +32079,23 @@ function createSSSStrategy(config) {
           current.shareVersion
         );
         pendingIdentityRecovery = void 0;
+        const { clean, ownWrongAttempts } = pinSignInClean(
+          [pinBefore, current.escrowPin],
+          pinAttempts
+        );
         return {
           mode: mode2,
-          newPinRequired: pinHasRecordedWrongAttempts(pinBefore) || pinHasRecordedWrongAttempts(current.escrowPin),
-          refreshCharges: refreshablePinCharges(pinBefore, current.escrowPin)
+          newPinRequired: !clean,
+          refreshCharges: clean ? refreshablePinCharges(pinBefore, current.escrowPin, ownWrongAttempts) : void 0
         };
       })
     );
     let pinRefreshed = false;
     let pinRefreshFailed = false;
+    let newPinRequired = newPinRequiredAtRelease;
     if (mode === "kept" && !newPinRequired && refreshCharges && params.signDidAuthVp) {
       const pinMaterial = await freshPinMaterial(pin);
-      pinRefreshed = pinMaterial !== void 0 && await tryEnrollEscrow(
+      const refresh = pinMaterial === void 0 ? void 0 : await attemptEnrollEscrow(
         params.token,
         params.providerType,
         released.privateKey,
@@ -31441,7 +32111,18 @@ function createSSSStrategy(config) {
         params.options?.recoveryLanguage,
         refreshCharges
       );
+      pinRefreshed = refresh?.enrolled === true;
       pinRefreshFailed = pinMaterial !== void 0 && !pinRefreshed;
+      if (pinRefreshFailed) {
+        const latest = await fetchAuthShareRaw(
+          serverUrl,
+          params.token,
+          params.providerType,
+          void 0,
+          tenantId
+        ).catch(() => void 0);
+        newPinRequired = latest ? !pinSignInClean([pinBefore, latest.escrowPin], pinAttempts).clean : isConflictRefusal(refresh && !refresh.enrolled ? refresh.error : void 0);
+      }
     }
     assertActive();
     return {
@@ -31529,7 +32210,7 @@ function createSSSStrategy(config) {
       pinSignIn: {
         mode: "relinked",
         pinRefreshed: false,
-        newPinRequired: pinHasRecordedWrongAttempts(status?.escrowPin)
+        newPinRequired: !pinSignInClean([status?.escrowPin], pending.pinKeep?.pinAttempts).clean
       }
     };
   }, "completePinSignInRelink");
@@ -32257,7 +32938,7 @@ function createSSSStrategy(config) {
         const verified = await verifyEscrowHoldRecord(
           result.holdRecord,
           {
-            tenant: tenantId ?? "learncard",
+            tenant: authorityTenant,
             did: expectedDid,
             holdId: result.holdId,
             clientEphemeralPublicKey: pair.publicKey,
@@ -32266,7 +32947,7 @@ function createSSSStrategy(config) {
           identity
         );
         expectations = {
-          tenant: tenantId ?? "learncard",
+          tenant: authorityTenant,
           did: expectedDid,
           holdId: result.holdId,
           clientEphemeralPublicKey: pair.publicKey,
@@ -32449,7 +33130,8 @@ function createSSSStrategy(config) {
               shareVersion: material.shareVersion
             },
             input.pin,
-            pinBefore
+            pinBefore,
+            input.pinAttempts
           );
         }
         pendingIdentityRecovery = {
@@ -32460,7 +33142,12 @@ function createSSSStrategy(config) {
           rebindSessionToken: material.rebindSessionToken,
           fromEscrow: true,
           // The PIN itself is not kept across the new-login step.
-          ...input.method === "escrow-pin" ? { pinKeep: { shareVersion: material.shareVersion } } : {}
+          ...input.method === "escrow-pin" ? {
+            pinKeep: {
+              shareVersion: material.shareVersion,
+              ...input.pinAttempts ? { pinAttempts: { ...input.pinAttempts } } : {}
+            }
+          } : {}
         };
         if (!token) return { privateKey: privateKey2, did: material.primaryDid };
         return completeIdentityRecoveryWith({